CVE-2025-52602

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-359

Affected software

Vendor	Product	Versions
HCL Software	BigFix Query	site version < 43

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124950

Timeline

Published: Nov 5, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-526033.5HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain lim CVE-2025-526064.3HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security CVE-2025-526084.3HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cook CVE-2025-526095.3HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-CVE-2025-52617.5Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Truste CVE-2025-526114.3HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined propert CVE-2025-526128.8HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. T CVE-2025-526138.8HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI ser CVE-2025-526144.3HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by f CVE-2025-526155.3HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for t CVE-2025-526167.5HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging know CVE-2025-526189.8HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipu